What's Updawg? Not much. Your servers are up to date.
Every server patched. Nothing changed you didn't approve.
Updawg shows every pending update across your Linux fleet, tells you which ones matter, and rolls them out in stages with health checks and an automatic halt. Review the risky changes; let policy ship the rest.
Free for up to five servers. No card. One-line install.
- Ubuntu
- Debian
- Red Hat Enterprise Linux
- AlmaLinux
- Rocky Linux
- Oracle Linux
- Amazon Linux 2023
Patching is the job everyone puts off. It shouldn't be.
Patch day eats the week
SSH loops, spreadsheets and a cron job nobody trusts. Updawg turns it into one review: what is pending, what it fixes, what it will touch.
Security debt you can't see
Ask which hosts are exposed to last week's CVE and get an answer in seconds, with the known-exploited ones at the top.
Upgrades that turn into emergencies
End of life arrives on a date you knew months ago. Updawg tells you early and checks a release upgrade before it starts.
Know
See every pending update, and which ones matter
- Every host's release, kernel, packages, pending updates and reboot state, in one place.
- Security updates matched to advisories from each vendor's own feed, rated, with known-exploited vulnerabilities flagged first.
- A calendar of every release you run, with warnings 180, 90 and 30 days before support ends.
Decide
Review the risky changes. Let policy handle the rest.
- Pending updates arrive as proposals: versions, changelogs, the CVEs they close, reboot impact and the hosts they touch.
- Policy in YAML decides what needs a person. Security patches on staging can go out on their own; a kernel on production always waits.
- Approve, reject, snooze or schedule into a maintenance window, with as many approvers as you require.
Ship
Roll out in stages, and stop when something breaks
- Canary hosts first, then waves, with soak time between them.
- Health checks run on the host after every change; a failure halts the rollout before it reaches the next wave.
- Snapshots before changes where the host supports them (Btrfs, ZFS, LVM thin), so rolling back is one click.
Every change arrives ready to review
A proposal says what will change, why it matters, what it fixes and how it will roll out. Approving it takes a minute instead of an afternoon of reading changelogs.
Security updates for web-prod
14 packages · 3 hostsAwaiting approval| Package | Change | Fixes |
|---|---|---|
| openssl | 3.0.13-0ubuntu3.4 → 3.0.13-0ubuntu3.5 | CVE-2024-5535 High |
| libssl3 | 3.0.13-0ubuntu3.4 → 3.0.13-0ubuntu3.5 | CVE-2024-5535 High |
| curl | 8.5.0-2ubuntu10.5 → 8.5.0-2ubuntu10.6 | CVE-2024-7264 Medium |
| + 11 more | ||
From install to first rollout in an afternoon
Install the agent
One line, or a package from our apt and dnf repositories. It starts observe-only: it reports and changes nothing.
See your fleet
Within a minute every host shows what is installed, what is pending, which CVEs are open and when its release ends.
Write a policy
Start from an example. Say what may go out on its own, what needs approval, and when the maintenance windows are.
Approve and roll out
Proposals arrive grouped by policy. Approve one and it rolls out in stages, with health checks between them.
Nothing changes on a host until you approve it or write a policy that says it may.
Built for
Platform and operations teams
Ten to a few thousand Linux servers across Ubuntu, Debian and the RHEL family. One view of all of them, and patching that no longer needs a free afternoon.
Managed service providers
An organization per customer, each with its own members, policies, keys and bill, and a switcher to move between them.
Regulated and security-conscious teams
Compliance reports on patch latency against your targets, a full audit log, single sign-on and SCIM, data kept in the EU or the US, and job-signing keys you can hold yourselves.
Fits the tools you use
- Slack
- Microsoft Teams
- PagerDuty
- ntfy
- Webhooks
- REST API
- Terraform and OpenTofu
Root on your servers, without blind trust
Installing packages needs root, so the agent has it. That is a large thing to ask, and the answer is not "trust us" — it is four properties built into the shape of the thing, which stay true even if our servers are taken over entirely.
- No inbound access
- The agent makes outbound HTTPS connections and nothing else. No listener, no open port, no SSH key to distribute or rotate. It works behind NAT and through strict egress firewalls because it never asks to be reached.
- No arbitrary execution
- Jobs are a closed set of typed operations. There is no variant that carries a script, a command line or a string to evaluate — not disabled, not guarded, absent. Full control of the Updawg control plane still cannot run a command of its choosing on your machines.
- Your config always wins
- The server can narrow what an agent will do and can never widen it. If /etc/updawg/agent.toml says this host never dist-upgrades, nothing we send changes that. An empty configuration permits nothing rather than everything.
- Signed, and verified against a pinned key
- Every job is signed by your organization's key, and the agent checks it against the key it pinned when it enrolled — not against whatever the server currently claims. Key rotation works by the old key endorsing the new one, so an agent can follow a rotation without simply believing us.
The agent is intended to be open source under Apache 2.0, because the only convincing answer to "what does it do as root?" is a repository you can read. It also collects a fixed list of things — packages, versions, repositories, and facts about the machine — and never file contents, environment variables, process arguments or credentials. Running updawgctl --print-inventory shows exactly what would be sent, so you never have to take that on faith either.
Patch your first five servers free
No card, no time limit. Upgrade when the fleet grows.
Pricing
Billed on active hosts per day — a host that checked in at any point that day (UTC). A machine you decommission stops costing you money tomorrow, with nothing to cancel.
Each host-day costs the monthly price × 12 ÷ 365: 6.58p on Team, 13.15p on Business, 26.30p on Enterprise. A host that is on all year costs exactly £24, £48 or £96; a month comes to a little less in February and a little more in a 31-day month.
Free
Individuals and homelabs
£0
up to 5 hosts
- Full visibility
- Policies and proposals
- Manual apply
- Email alerts
- Support replies within 2 business days
Team
Small teams
£2
per active host per month, billed by the day
- Everything in Free
- Unlimited hosts
- Auto-merge
- Staged rollouts
- Slack, Teams, ntfy and PagerDuty
- 90-day history
- Support replies within 1 business day
Business
Growing companies
£4
per active host per month, billed by the day
- Everything in Team
- Maintenance windows
- Snapshots and rollback
- API tokens and webhooks
- 1-year history
- Compliance reports
- Support replies within 4 business hours
Enterprise
Regulated organisations and MSPs
£8
per active host per month, billed by the day
- Everything in Business
- Single sign-on (OpenID Connect)
- SCIM provisioning
- Customer-held signing keys
- Urgent support within 1 hour, around the clock
- SAMLcoming soon
- Multi-org managementcoming soon
- SLAcoming soon
Questions people ask
- What counts as an active host?
- A host whose agent checked in at any point during a day, in UTC. Every running agent checks in about once a minute, so a host that is up is active, and one that is switched off for a day is not billed for it.
- Is there a free trial?
- No, because Free does that job: up to five hosts, policies included, for as long as you like. Paid plans are billed by the day, so trying Team for a week costs a week.
- What happens at the sixth host on Free?
- It is refused when it enrols, with a message saying why. Your five keep working exactly as before. Decommission one to make room, or move to Team.
- How quickly will support answer?
- Write to help@updawg.net. Business hours are 9:00 to 17:00 UK time, Monday to Friday, and the first reply comes within 2 business days on Free, 1 business day on Team and 4 business hours on Business and Enterprise. On Enterprise, an outage or a security problem gets a reply within an hour at any time of day. These are targets we hold ourselves to, not a contractual SLA.
- Do I pay for hosts I have retired?
- No. Decommission a host and it stops counting from the next day. There is nothing to cancel and no minimum.
- Can I change plan in the middle of a month?
- Yes. The days before the change are billed at the old plan's rate and the days after at the new one's, on the same invoice.
- When am I invoiced, and how do I cancel?
- On the 1st, for the month before. Cancelling takes effect at the end of the month, and that month's usage is on its last invoice. Invoices, your card and cancelling are all in Settings, through Stripe; Updawg never sees your card.
- What happens if a payment fails?
- Updawg does not stop patching your fleet because of an invoice. Hosts keep checking in and approved changes keep going out; what a lapsed subscription loses is setting up new paid features.
Beta
Updawg is running and open to sign up. It is in beta because it is new: expect rough edges, and expect them to be fixed quickly when you tell us at hello@updawg.net. Paid plans are billed as described above, and there is no SLA during the beta.
Working today
- The agent, as packages for Debian, Ubuntu, the RHEL family and Amazon Linux 2023, or a one-line install. It keeps itself up to date when you let it.
- Advisories from Ubuntu, Debian, Red Hat, AlmaLinux, Rocky Linux and Oracle Linux, each from its own vendor's feed, matched to every pending update and rated.
- Proposals, policies, approvals, staged rollouts with health checks, and snapshots with rollback where the host supports them.
- Notifications to email, Slack, Teams, ntfy, PagerDuty and webhooks; API tokens; a Terraform and OpenTofu provider; compliance reports; single sign-on and SCIM.
- Data kept in the EU or the US: you choose the region when you create an organization.
Who builds Updawg
Rasmus Wejlgaard
Founder & CEO
I've spent over ten years in platform and cloud engineering, at companies including CapitalOnTap, Expedia Group and GoHenry. At home I run about a dozen servers of my own, and keeping them updated and upgraded was eating the time I wanted to spend actually using them.